Skip to content
Permalink
Browse files

src: fix out-of-bounds write in TwoByteValue

Plan 2 bytes instead of 1 byte for the final zero terminator
for UTF-16. This is unlikely to cause real-world problems,
but that ultimately depends on the `malloc` implementation.

The issue can be uncovered by running e.g.
`valgrind node -e "Buffer(65536).fill('a'.repeat(4096), 'utf16le')"`

Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
PR-URL: #6330
  • Loading branch information...
addaleax committed Apr 21, 2016
1 parent 0e7d57a commit a3b5b9cbf2cb858bdb7c5e5b1e3c8b92c43a1c4a
Showing with 3 additions and 1 deletion.
  1. +3 −1 src/util.cc
@@ -47,7 +47,9 @@ TwoByteValue::TwoByteValue(Isolate* isolate, Local<Value> value)
return;

// Allocate enough space to include the null terminator
size_t len = StringBytes::StorageSize(isolate, string, UCS2) + 1;
size_t len =
StringBytes::StorageSize(isolate, string, UCS2) +
sizeof(uint16_t);
if (len > sizeof(str_st_)) {
str_ = static_cast<uint16_t*>(malloc(len));
CHECK_NE(str_, nullptr);

0 comments on commit a3b5b9c

Please sign in to comment.
You can’t perform that action at this time.